Management and boards continue to recognize the importance of effectively managing information technology (IT) assets ― to meet business objectives and to thoughtfully manage IT related business risks. This course examines the key principles related to auditing information technology processes and related controls and is designed to meet the increasing needs of audit, compliance, security and risk management professionals.

Course Objectives:

Through the application of COBIT® and other similar governance frameworks, learners will develop a common vocabulary for understanding sources of IT risk and performing an IT audit. Learners will further gain hands-on experience in analyzing and assessing IT risks and controls through various case studies, lectures, and discussions.

The primary objectives of the course are to:

Establish an understanding of the IT environment and the role of the IT auditor,

Recognize how corporate and IT governance practices impact the IT audit process,

Develop an understanding of the IT audit process i.e., risk assessment, planning, standards, guidelines and best practices, and

Survey IT audit approaches to: – Systems development and maintenance, – IT security, – IT service delivery and support, – Business continuity and disaster recovery, and – Data analytics and fraud detection.

Module 1

 The Process of Auditing Information Systems Provide audit services in accordance with IS audit standards to assist the organization in protecting and controlling information systems.

• Execute a risk-based IS audit strategy in compliance with IS audit standards to ensure that key risk areas are audited
• Plan specific audits to determine whether information systems are protected, controlled and provide value to the organization
• Conduct audits in accordance with IS audit standards to achieve planned audit objectives
• Communicate audit results and make recommendations to key stakeholders through meetings and audit reports and other substantive/data analytical procedures to promote change when necessary
• Conduct audit follow-ups to determine whether appropriate actions have been taken by management in a timely manner

 Module 2

Governance and Management of IT Provide assurance that the necessary leadership and organizational structures and processes are in place to achieve objectives and to support the organization’s strategy

• Evaluate the IT strategy, including IT direction, and the processes for the strategy’s development, approval, implementation and maintenance for alignment with the organization’s strategies and objectives
• Evaluate the effectiveness of the IT governance structure to determine whether IT decisions, directions and performance support the organization’s strategies and objectives
• Evaluate the organization’s IT policies, standards and procedures, and the processes for their development, approval, release/publishing, implementation and maintenance to determine whether they support the IT strategy and comply with regulatory and legal requirements
• Evaluate IT resource management, including investment, prioritization, allocation and use, for alignment with the organization’s strategies and objectives
• Evaluate IT portfolio management, including investment, prioritization and allocation, for alignment with the organization’s strategies and objectives
• Evaluate risk management practices to determine whether the organization’s IT -related risk is identified, assessed, monitored, reported and managed
• Evaluate monitoring and reporting of IT key performance indicators (KPIs) to determine whether management receives sufficient and timely information

Module  3 – Information Systems Acquisition, Development and Implementation Provide assurance that the practices for the acquisition, development, testing and implementation of information systems meet the organization’s strategies and objectives.

• Evaluate the business case for the proposed investments in information systems acquisition, development, maintenance and subsequent retirement to determine whether the business case meets business objectives
• Evaluate IT supplier selection and contract management processes to ensure that the organization’s service levels and requisite controls are met
• Evaluate the project management framework and controls to determine whether business requirements are achieved in a cost -effective manner while managing risk to the organization
• Conduct reviews to determine whether a project is progressing in accordance with project plans, is adequately supported by documentation, and has timely and accurate status reporting

Domain 4 – Information Systems Operations, Maintenance and Service Management Provide assurance that the processes for information systems operations, maintenance and service management meet the organization’s strategies and objectives.

• Evaluate the IT service management framework and practices (internal or third party) to determine whether the controls and service levels expected by the organization are being adhered to and whether strategic objectives are met
• Conduct periodic reviews of information systems to determine whether they continue to meet the organization’s objectives within the Enterprise Architecture (EA)
• Evaluate IT operations (e.g., job scheduling, configuration management, capacity and performance management) to determine whether they are controlled effectively and continue to support the organization’s objectives
• Evaluate IT maintenance (patches, upgrades) to determine whether they are controlled effectively and continue to support the organization’s objectives

Module 5 – Protection of Information Assets Provide assurance that the organization’s policies, standards, procedures and controls ensure the confidentiality, integrity and availability of information assets.

• Evaluate the information security and privacy policies, standards and procedures for completeness, alignment with generally accepted practices and compliance with applicable external requirements
• Evaluate the design, implementation, maintenance, monitoring and reporting of physical and environmental controls to determine whether information assets are adequately safeguarded
• Evaluate the design, implementation, maintenance, monitoring and reporting of system and logical security controls to verify the confidentiality, integrity and availability of information
• Evaluate the design, implementation and monitoring of the data classification processes and procedures for alignment with the organization’s policies, standards, procedures and applicable external requirements

Trainers without Borders offers customised solutions for your training needs. Please contact us for course pricing and more information.